Skip to content

Security and compliance

Every figure has a source, a date and a signature.

An assessment is only as valuable as your ability to defend it. That is why security at CALMO is not an add-on: it is how evidence is produced, preserved and delivered.

Custody chain at a glance

  1. Sourceread-only
  2. CollectionSHA-256 at source
  3. Single databasevalidation = source
  4. Assessmenttraceable workpapers
  5. DeliveryICP-Brasil + 5 TSAs
  6. Retentionimmutable · 10 years · BR, US or MC

Per-client isolation

Nothing is shared between clients: not storage, not databases, not keys.

  • Each client has its own logical environment, storage areas, database and encryption keys.
  • The database has no public access; technical access goes through a managed tunnel, with no ports open to the internet.
  • Every query is run by the CALMO team at the request of an authorized person and restricted to the client and to the companies (CNPJ) that person may access.
  • Service to authorized people only: each company defines who may request queries and reports and what each person may receive.
  • Credentials are kept in a secrets vault — never in repositories, reports or e-mail. Access granted in the client's environment is reverted at the end of the project.

Chain of custody

Proof of integrity from the source, not only at the destination.

  • Collection record signed by the client: scope, sources, dates, responsible persons and authorization.
  • SHA-256 computed at source for every package and every file, checked at destination; any discrepancy triggers a resend.
  • File-by-file manifests and record counts per table, which form the basis for validation.
  • Custody log: who, when, from where, to where and with which hash. The original is never altered.

10-year immutable retention

Any future challenge can be answered with the same database, in the same version.

  • Object-lock storage in compliance mode for 10 years: not even the account administrator can alter or delete it.
  • Versioning, encryption with managed keys and public access blocked.
  • Retention date recorded per collection batch and a denied-deletion test documented as evidence.

Timestamping

Proof that the content existed, exactly as it is, on that date.

  • RFC 3161 timestamps issued by 5 independent international authorities — FreeTSA, DigiCert, Sectigo, GlobalSign and SSL.com — over the hash of every delivery.
  • Deliberate redundancy: proof of date does not depend on a single issuer and remains verifiable even if one of them ceases to operate.
  • The hash of every delivery is recorded in retention, so integrity can be verified at any time.

ICP-Brasil signature

Deliveries verifiable by third parties, without relying on CALMO.

  • Reports and packages in PDF/A, digitally signed (PAdES) with an ICP-Brasil certificate.
  • Signature verifiable in the official ITI validator; timestamps verifiable against each authority's public chain.
  • Joint technical responsibility: the report is signed by the CALMO team and by the partner's specialist.

LGPD

The data belongs to the client. We process only what is needed to perform the contracted service.

  • Processing limited to performing the service, under the confidentiality and data-protection terms agreed — in a single agreement signed with an ICP-Brasil certificate.
  • Sensitive personal data, confidentiality and sealed proceedings identified at the diagnostic stage and handled under specific restrictions.
  • Every Data Center query is logged: user, company, period and result.
  • Data exportable at any time; at the end of the contract, originals remain only in the contracted retention.

For data processed on this website, see the Privacy Policy.

Retention jurisdiction

Physical storage of data in the jurisdiction the client chooses.

When contracting, the client decides where the archive, the single database and the immutable retention are physically stored. The choice is set out in the agreement and does not change without the client's authorization.

  • BrazilCloud in São Paulo, under Brazilian law and the LGPD.
  • United StatesCloud in the United States, for groups with international operations or requirements.
  • MonacoSovereign datacenter within the Principality of Monaco.

The terms for each jurisdiction are set out in the proposal.

Need to present the methodology to your client or your DPO?

We send the technical custody and security documentation to accredited partners.

Request documentationSee our approach